Welcome, Guest. Please login or register.
Did you miss your activation email?
November 21, 2017, 01:48:50 PM
Home Help Search Login Register
News:

+  DIY DataRecovery.nl Support forum
|-+  Support
| |-+  iUndelete (Moderators: Tom, Joep)
| | |-+  Undelete encrypted files under /home/$USER/.Private folder
0 Members and 1 Guest are viewing this topic. « previous next »
Pages: [1] Go Down Print
Author Topic: Undelete encrypted files under /home/$USER/.Private folder  (Read 5045 times)
qiubosu
member

Posts: 1


« on: April 02, 2015, 04:16:26 AM »

1) Recently I incidentally deleted a lot of files (the encrypted files under /home/$USER/.Private folder, about 140GB in total. some of the VM files size is about 20GB. the /home/ folder is on /dev/sda5 partition with ext4 Linux LVM file system. recently i run "rm -rf .Private" under /home/$USER folder to incidentally deleted almost all the files under /home/$USER folder) from the Ubuntu 64 bits Server OS system server (i updated it from Ubuntu 12.04 to Ubuntu 14.04 in a couple of months ago), and I'm in the process to recover them with extundelete, photorec, ext3grep, testdisk etc. recovering tools (with Ubuntu 14.04.2 LiveCD), but none of them can successfully recover all the deleted files as expected.

It is much appreciated if you can help to have a look at my case and let me know whether your services/products can help to undelete all these data as expected.

2) The progress of my data recovery is as below:

With photorec i recovered about 30GB files, not all the 140GB, to the external HD.

When run "extundelete --restore-all /dev/mapper/ubuntu--vg-root" command, I can only recover about 700M files and get a lot of console output of "Unable to restore inode xxxxxx ...... : Space has been reallocated" and the final console output is "Failed to restore inode xxxxxx to file RECOVERED_FILES/xxxxxx: Some blocks were allocated".

The testdisk and ext3grep tools don't look as good as photorec and extundelete tools in my case.

When the /home/$USER/.Private folder (in /dev/sdb5 partition with ext4 Linux LVM file system) was "rm -rf ./Private"), I don't know I need to turn off the PC immediately, while leave it running for about two days, run "apt-get update" for a couple of times, but didn't create any folders or add any files to this partition.

I made a image copy of the whole drive /dev/sdb with dd command before I start to recover the deleted data.

The data recovering tools I have used so far are open source ones. It is much appreciated if you can recommend me some better tools so can recover all the deleted data.

Thank you very much for your help and have a great Easter !
Logged
Joep
Developer and Support Tech
Administrator
member
*****
Posts: 1457


WWW
« Reply #1 on: April 02, 2015, 08:49:43 AM »

Hello,

It is my understanding that metadata is zeroed when deleting a file on ext4 and thus recoverabilty of deleted files is generally poor. Since metadata is zeroed a file carver like photorec is the best option. Recovery results of file system oriented tools will roughly all be the same, so don't expect iRecover to do better than Testdisk in this case.
Logged

--
Kind regards,
Joep
Pages: [1] Go Up Print 
« previous next »
Jump to:  


Login with username, password and session length

Powered by MySQL Powered by PHP Powered by SMF 1.1.20 | SMF © 2013, Simple Machines Valid XHTML 1.0! Valid CSS!